Fast controlled unitary protocols using group or quasigroup structures 



Li YiE 

Department of Physics, Carnegie-Mellon University, Pittsburgh, Pennsylvania 15213 
(Dated: Version of December 5, 2011) 

A nonlocal bipartite unitary gate can sometimes be implemented using prior entanglement and 
only one round of classical communication in which the two parties send messages to each other 
simultaneously. This cuts the classical communication time by a half compared to the usual pro- 
tocols, which require back-and-forth classical communication. We introduce such a "fast" protocol 
that can implement a class of controlled unitaries exactly, where the controlled operators form a 
subset of a projective representation of a finite group, which may be Abelian or non-Abelian. We 
also introduce a modified version of the protocol for the approximate implementation of controlled 
unitaries. This protocol uses the algebraic structure of right quasigroups, which are generalizations 
of quasigroups, the latter being equivalent to Latin squares. We then show that by using enough 
, entanglement, this fast protocol can implement all controlled unitaries approximately. In doing so 

■ we have effectively discussed an approximation of the special unitary group SU (d) by some right 

quasigroup. The entanglement cost of our protocols is compared with other fast unitary protocols 
in the literature. The cost is quite small when the form of the unitary is relatively simple. 
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Ph! I. INTRODUCTION 

, Entanglement assisted by classical communication and local quantum operations can be used to carry out nonlocal 
^ ' unitaries. This has been the subject of various studies ^ more extensive list of papers see In the paper 

O^i [H we considered protocols that require less time in classical communication than the usual protocols. In these fast 
• protocols, the classical communication in the two directions are carried out simultaneously. The ability to implement 
I nonlocal unitaries rapidly may be helpful in reducing the effects of noise and decoherence in distributed quantum 
^ , computation Also, the fast unitary protocols have found applications in position-based quantum cryptography 

[9l-tl2l|. where they are used to attack certain position verification schemes. 
, Some work in the literature on this topic include Groisman and Reznik [l3| for a CNOT gate on two qubits, and 
■ Dang and Fan [l3| for its counterpart on two qudits. In addition Buhrman et al. [HI and Beigi and Konig [Tl] 
C5 _ have discussed approximate schemes for what they call "instantaneous quantum computation" , equivalent to a fast 
psj ■ bipartite unitary in our language. In Sec. IV Al of this paper we will see that the main protocol in [l^ for nonlocal 
T-H ' measurements can also be adapted to a fast unitary protocol. 

. In [l| , we had identified two classes of nonlocal unitary that lend themselves to a fast protocol: controlled unitaries 
" ^ [ ' of the form shown in ([1]) below, where the controlled operators form a subset of an ordinary representation of an 
J> , Abelian group (or a subset of a projective representation of a cyclic group); and double-group unitaries. We also 
showed that by increasing the amount of entanglement expended, additional unitaries can be (approximately) carried 
^ , out using these fast protocols. 

' In this paper, we discuss a more general fast controlled unitary protocol, where the controlled operators form 
" ■ ' a subset of a projective representation of a finite group (could be Abelian or non-Abelian). We also introduce a 
modified version of this protocol that uses a right quasigroup structure, and show that it can be used to implement 
all controlled unitaries approximately. We also compare the entanglement cost of this protocol with some other fast 
unitary protocols, some of which are adapted from the "instantaneous measurement" protocols, such as the one in 
Clark et al. [IH. 

The paper is organized as follows. In Sec. |TT] a protocol for controlled unitaries is introduced, where the unitaries 
being controlled form a subset of a projective representation of a finite group. Section [ITT] describes a modified version 
of this protocol which uses a right quasigroup structure. Section HVl applies the protocol in Sec. Illll to approximately 
implement any controlled unitary in the fast way, and also includes an example showing that the entanglement cost 
can be reduced for some special cases. In Sec. |V] we first describe how the instantaneous nonlocal measurement 
protocol in [iGj can be adapted to a fast unitary protocol, and then compare the entanglement cost of various fast 
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unitary protocols when they are used to implement controlled unitaries. The concluding Sec. I VII contains a brief 
summary along with some open problems. 



II. FAST PROTOCOL FOR CONTROLLED-GROUP UNITARIES 

In this section we construct a fast protocol for any controlled unitary of the form 

M-l 
k=0 



(1) 



where the Pk are orthogonal projectors, possibly of rank greater than 1, on a Hilbert space Ha of dimension d-A, and 
the {Vk} are unitary operators on a Hilbert space of dimension cIb that form a subset of a projective representation 
of a group G of order N > M. As shown in Appendix A of [ij, it suffices to consider projectors of rank 1. That is, a 
scheme for implementing 



Af-l 



U=J2 \k){k\(i^Vk. 



(2) 



k=0 



where denotes a ket belonging to a standard (or computational) orthonormal basis, is easily extended to one that 
carries out the more general ([T]). 
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FIG. 1: The fast protocol for implementing the unitary U = X]fe=o^ l^)^^! ® ^k, where {Vk} is (a subset of) a projective 
representation of a finite group of order A'^, and M < N. 



A. The case of a whole representation 

Let us first consider the case that {14} in ^ are a full projective representation of a group, i.e. the case M — N. 
(For some background knowledge about projective representations, see Chap. 12 of J7].) Each integer k between 
and — 1 identifies an element of the group. Assume the factor system of the projective representation is {X{g, /i)}, 
defined through the following equation: 



VgVh^X{g,h)Vgh, 



(3) 



where gh denotes the group product of the group elements g and h. For convenience we let fc = denote the identity 
element of the group, then Vq is proportional to the identity matrix. And without loss of generality we assume Vq 
is exactly equal to the identity matrix. (This is because the phases of the Vk can be adjusted by doing a diagonal 
unitary on Ha-) The protocol is shown in Fig. (TJ where 



N-l 



(4) 
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is a fully entangled state on the ancillary systems a and h associated with A and B, respectively, and the gates i?^, 
F and are defined by 

^ \j) 



mJ—O 

fe=0 

where is the group inverse of j, and the * symbol denotes the multiplication of group elements, where the two 
operands and the product are all labeled by integers between and — 1; the multiplication between m and j or 
between m and (/ * k) is the usual multiplication of integers. 

The protocol proceeds as follows: Alice carries out a controlled- gate on her systems A and a, and Bob carries 
out a controlled- Vfc gate on his systems b and B. Then Alice measures a in the standard basis, with the outcome 
denoted hy I {0 < I < N — 1), and at the same time Bob does a F (Fourier) gate on b and measures in the standard 
basis, with the outcome denoted by m (0 < m < iV — 1). They each send the local measurement outcome to the 
other party, and then Alice does a unitary gate on A, and Bob does a unitary Vi-i gate on B. They have then 
implemented U on AB. 

Note that there are other choices for the gate F (when F changes, the Di„i gate changes accordingly), and we have 
chosen the Fourier gate for simplicity. In the controlled- Abelian-group protocol in our previous paper 1] , we had used 
some other gate on b in place of the Fourier gate, and accordingly the final local correction on A was different from 
the Dim above. But since our current protocol works for any group G, it should work for the special case of Abelian 
groups, hence the current choice of F and Dim represent another way of implementing the controlled- Abelian-group 
unitaries. 

Now we show a calculation about how the input state evolves under the protocol. Suppose the input state on AB 
is = Sfeio^ \^)a ^ |V'/c)b- (Although M = for the current case of a whole representation, we deliberately 

use M instead of N to illustrate that the protocol still works in the case of a subset of a representation discussed 
in Sec. Ill Bl ) The joint state on AabB after Alice's controlled- gate and Bob's controlled- gate is shown in the 
second line below, and the next steps of state evolution are shown in the subsequent lines: 



^ H H ^ \j)b ® \k}A ® \i'k)B 



N 

j=0 k=0 

N-1 M-1 



j=0 fc=0 ^-^ '■'^ 

N-1 N-1 A/-1 



^ ^ E E E /A^^^lf^b- * k-')a « |m), ® \kU « VM 

measure a,b 2Tvim(i*k)/N H^, * l^^) 



ire a,b sr^ ^2Trim(l*k)/N ^1^-, t ) \ ,„\ ^ rr I,/, \ 



(=j*fc-i ^ A(fc^i * Z^i, Z * fc) 

M-l 

D. 



k=0 



k=0 



let j:=l*k 



E U-\ ■. \k)A®VkV,-^VMB 
k=0 

M-l M-1 

\k)A ® VkVomB = 1^)^ ^ VMb = (6) 
k=0 k=a 
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where in deriving the last and second-to-last lines we have used the defining equation ^ for factors in a factor system. 

Example 1. Suppose ds = 2 and the Vk are in the set of Pauli operators {/, X, Y, Z}, and suppose each of the Pauli 
operators appear at least once as some Vk in the expression ofU. We can take G to be the C2 x C2 group of order 4 
(the Klein four-group), and combine the terms in U with the same Vk, so that the bipartite unitary U = X^felo^ Pk'S)Vk 
can be rewritten in the form X]i=o ® '^J' '^here (Tj are the Pauli operators. Then we can use the fast protocol in 
this section to implement U with only a maximally entangled state of Schmidt rank 4. 

B. Subset of a group representation 

Assume that the {Vk} form a projective representation of a group of order N, but the sum over k in ([T]) is restricted 
to some subset S of integers between and A'' — 1. By relabeling some basis states on A, the set S can be assumed to 
be the set of integers between and M — 1, where M < N. It will suffice once again to consider the case of rank-one 
projectors, i.e., The protocol has the same circuit diagram as shown in Fig.[Il but with Rk^s restricted to those 
< A; < M — 1. The state evolution calculated in jf6]) still holds, hence the protocol still works. This discussion of 
the "subset" case is similar to that in Sec. II C of where the case of a subset of an Abelian group representation 
was discussed. 

Example 2. Similar to Example 1, let Vk be the Pauli operators, but now not all of them need to appear in U. 
One such bipartite unitary is U — Pq (E) Ib + Pi ^ Xb + P2® Zb- The group G is still the G2 x C2 group, and the 
entanglement cost of our protocol is still 2 ebits. 

III. FAST PROTOCOL USING A RIGHT QUASIGROUP 

The use of groups and their unitary representations proved to be very helpful in designing various protocols for 
nonlocal unitaries (e.g. [l|, 0] and the protocol in the previous section). In this section we introduce two more 
general types of algebraic structures named quasigroup and right quasigroup, and define an "approximate unitary 
representation" of right quasigroups, and then describe a fast approximate controlled unitary protocol where the 
controlled operators form such a representation. 

A quasigroup is an algebraic structure resembling a group, but the multiplication need not be associative and there 
need not be an identity element. More explicitly (see [iSj), a quasigroup {Q, *) is a set Q with a binary operation *, 
with the property that for any two elements a and 6 in Q, there exist unique elements x and y in Q such that 

a* X = b, (7) 
yifa — b. (8) 

The multiplication table (Cayley table) of a quasigroup is a Latin square, the latter defined as an n x n array filled with 
n different symbols, each occurring exactly once in each row and exactly once in each column. And each Latin square 
is the multiplication table of some quasigroup. A special type of quasigroup is called loop. A loop is a quasigroup 
with an identity element e such that 

x*e~x — e*x. (9) 

It follows that the identity element e is unique, and that every element of Q has a unique left inverse and a unique 
right inverse. A right quasigroup (Q, *) is a set Q with a binary operation * that only satisfies ([5]) and does not need 
to satisfy . A right quasigroup with an identity element satisfying ^ is called a right loop. 

Next we discuss the concept of an "approximate unitary representation" of a right quasigroup which is useful for 
the nonlocal unitary protocols. 

Definition 1. (Approximate unitary representation of a right quasigroup) Define the approximate unitary represen- 
tation of a right quasigroup (Q, *) to be a set of unitary operators {Vi : i G Q} satisfying that for any k Cz Q, 

||V;(j ^;)Vfe — Vjlloo < Vi fof o,t least N{1 — 5) distinct values of j, (10) 

where N is the size of Q, l{j,k) is the unique element in Q that satisfies l{j,k) *k ^ j, and rj and 6 are positive 
constants. The \\ ■ ||oo notation in (jlOp denotes the maximum singular value of an operator. 
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Note that the || • [[^ norm in this paper is the Schatten p-norm with p = oo. This should not be confused with the 
induced norm (see [l9[ for the definition of both types of norms); in fact our norm is the same as the induced norm 
with subscript 2, instead of oo. 

Now we introduce a fast protocol, shown in Fig. [5J for implementing controlled unitaries, where the controlled 
operators form a subset of an approximate unitary representation of a finite right quasigroup Q. In this paper we 
always include the identity operator in an approximate unitary representation of a right quasigroup, hence the right 
quasigroup under consideration is actually a right loop. Both and S in (fTU)) are related to the closeness of the 
implemented quantum operation to the desired unitary, see (j20[) . Let each integer k between and — 1 identify an 
element of Q. The circuit diagram for the protocol is shown in Fig. [2j It resembles the circuit in Fig. [T] except for the 
definition of a few gates. 
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FIG. 2: The fast protocol for implementing the unitary U — X^j^gg \k){k\ Cgi Vk, where 5 is a subset of a finite right quasigroup 
Q, and {14 : k £ Q} is an approximate unitary representation of Q (see Definition 1). 

In Fig. [21 is equal to Vi~^, as Vi is unitary. The Rk and Dim gates are defined as follows: 

i?fe = ^|?(j,fc))(j|, \fkeS, 

A™ = 5]e-2"'"('*'^-)/^|fc)(fc|, V/,meQ (11) 
fees 

where k) is the unique element in Q that satisfies /(j, k) * k — j; and I * k is the product of I and k in Q; the 
multiplication between m and {I * k) is the usual multiplication of integers. From the definition of a right quasigroup, 
j — I k is unique for fixed I and fc, and I is uniquely determined by j and k, hence each Rk is a permutation matrix. 

This fast protocol implements one unitary in the set of unitaries {Ui} depending on the measurement outcome 
The state evolution of this protocol is as follows: 

7^ H H 1-?')'^ ® 1^')'' ® 1^)^ ^ 1'^'=)^ 

j^Q k=0 

^^T^E E \Kj,k))a<E>\j)b<E>\k)A<E>V,\tPk)B 
j=0 k=0 
N-1 N-1 M-1 

^ ]^ E E E ® Hb ® \k)A ® VMb 

j=0 m=0 k=0 
M-1 

measure a,b 
> 



fc=0 



^ E \k) A ® V(^uk)\i^k) B 

k=0 
^ M-1 

^ E \k)A(i>V^V(^i,k)\^k)B 

k=0 
M-1 

\k)A ® (14 + Ek,l)\^Pk)B = Kl^AB, (12) 
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where in the last Une Ek,i := V^V(i^k) - 14. From and using || V;'''(V(;h.a:) - ViVk)\\oo = \\V(i^k) - V^FfcHoo, we get 
that for any fixed k, 

\\Ek,i\\oo < '7, for at least A^(l — 6) distinct values of I. (13) 
The average quantum operation performed on AB is 

E{pab) ^ j^Y^^iP^bU} ^ -Y. E m{k\®(yu+Eu,)]pAB[\k'){k'\®{Vk-+Ek>,i)\ (14) 

/=0 1=0 k,k'=0 

where the factor is just the probability that the measurement outcome I occurs. (This probability is the same for 

all /, because ah Rk are permutation matrices.) Since \\EkA\\oc ^ ||V;V(;,fc) - Vk\\oo < || V^V(i,fc) ||oo + ||Vfe||oo = 2 is 
always bounded, we have that when i] and S approach 0, the second line above is arbitrarily close to 

£u{pab)-=UpabU^ =Y. Y.^\^)^^\®^^'^P^B{\k'){k'\®Vk')^. (15) 

k=0 k'=0 

But this docs not immediately imply that the superoperators £ and £u coincide when 77 and S approach 0, due to 
the dependence on the input state pab in the argument above. In the following we show that £ and £u are indeed 
arbitrarily close to each other when and 6 approach 0, although some Ui might not be close to U. This distance of 
two superoperators will be measured using the diamond norm of their difference: \\£ — £u\\<>-, see a definition of the 
diamond norm in Eq. (7) of [isj . Our ar gum ent, which makes use of Theorem 6 in |20| . is shown as follows; 

Setting the £ and £' in Theorem 6 in [2C| to be the £i{ and £ in this paper respectively, we get that \\£u — < 
2\\U' ~ V^'lloo, where U' is an isometric dilation for U, and V' is an isometric dilation for the channel £ in this paper: 



^ 1=0 

N-l 

V ^ ^ZY,€§|0(0|. (16) 
^ 1=0 

In (fT6|l . the U and Ui act on the systems AB, and the operators \l){0\ act on an ancillary system R. Then 

\\u'-v'\u = ||^5](z^-z^O®IO(o|||oo 

^ l=Q 

N-lM-1 

= IIT^E E \k){k\<E>{-Ek,i)i 

V J* J n z — n 



;=0 fe=0 



sup|(^^ J2 \k){k\^Ek,i^\l){Om\, (17) 



where | |0) | := ■\/ {(plcj)) , and the ket \ip) is defined on the combined ABR system, with an expansion of the following 
form: 



M-l 



k=0 
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where \4'k) are normalized, and pk are probabilities satisfying ^ 
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l,k^C 
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(19) 



where in the second-to-last line the C is the set of (fc, /) pairs that satisfy ||£'fc,!||oo < V: see (|T3|) . In the last line we 
have used (fTS]). and the inequality ||-Bfe,z||oo < 2 stated after (fT4|). Hence we have 



Theorem 1. For t/ie /asi controlled unitary protocol in this section, with the controlled operators Vk satisfying 
Definition 1, the ideal quantum operation Sjj and the implemented quantum operation £ are related in the following 
way: 



\£u-£\\o < 2\\U'-V'\ 



AS. 



(20) 



It should be noted that the protocol introduced above also works for the restricted case where the right quasigroup 
is actually a quasigroup. Another side remark is that, for some suitable {Vk} set, it is possible to do post-selection 
to approximate U more accurately: retain the output only when the measurement outcome I is such that the cor- 
responding lAi is very close to Li, otherwise declare failure. This makes the postselected average quantum operation 
closer to lA, at the expense of having some probability of failure. 



IV. APPROXIMATE FAST PROTOCOL FOR ANY CONTROLLED UNITARY 



We now show that the protocol introduced in Sec. IIIII can be applied to approximately implement any bipartite 
controlled unitary in the fast way. 



A. Protocol 



It suffices to consider the controlled unitary of the form ([2]): U — Yl,k=Q ® ^fc- Since phases on the Vfc's can 

be adjusted by a diagonal unitary gate on T-La, we can assume that Vk all have determinant 1, i.e. they are all in 
the special unitary group SU{dB)- The general idea of this section is that the unitaries {Vfe:0<fc<M— 1} are 
approximately a subset of an approximate unitary representation of a finite right quasigroup, hence our fast protocol 
in Sec. IIIII can be applied to implement the controlled unitary U approximately. 

First we introduce some literature results on decomposing a unitary in the special unitary group SU{d). In Sec. 4 of 
[21} it is shown that there is a set Gd of unitaries in SU{d) such that any unitary U in SU{d) can be approximated by 
a product (denoted by W) of [Clog 7J + 1 gates in the set Qd, where e is the desired precision of the approximation: 
— W^lloo < e (i-e. the maximum singular value oiU — W is less than e), and the constant factor C depends on d and 
the details of the set Qd- According to the derivations in Sec. 2 of [21], the inverses of elements of Qd can also occur 
in the products of gates; this is reasonable, since this can be equivalently treated as adding all inverses of elements 
in Gd hito the set, which would at most enlarge Gd by a factor of 2 and therefore does not influence the complexity 
analysis significantly. 

In the following we are going to use a subset of all products of a certain number of operators from Gd- This is the 
Rm set defined in the proof of Proposition 5 of [2l|. Each operator in Rm is a product of Tnd{d — l)/2 operators in 
Gd- The set i?™ satisfies Eq. (21) in [2i|: 



A(i?.) < fc^A", 



(21) 
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where A is a measure for the closeness of Rm to the uniforni distribution in SU{d), as defined in Eq. (8) in [2l[; A 
is a constant smaller than 1. Hence A(i?m) < i for m > clog2d, where c is some constant, and when m is further 
increased, A{Rm) decreases exponentially, hence the distribution of the operators in Rm approaches the uniform 
distribution in SU{d) in an exponentially fast manner. And since each operator in i?,„ is the product of md{d — l)/2 
operators in Qd, we have that any unitary in SU{d) can be approximated using a product of length 

Lo = 0{d^m) = 0{d^{logd + log-)), (22) 

e 

where e is the desired accuracy of approximation, as defined in the previous paragraph, and the log ^ term in m 
comes from similar arguments as in the proof of Theorem 1 of [2l| (a rough explanation is that A{R„i) decreases 
exponentially with the increase in m). 

Denote d := ds- With the preparation above, we do the following for the current controlled unitary problem: for 
the given Vfe's, all of determinant 1, we fix an error parameter e, and find the closest approximation of each Vk in terms 
of an operator in Rm , where m — [c(log d + log ^ )J , with c being some constant independent of d and e. Denote these 
approximations to Vk by Wk, < k < M — 1, then we can always include other unitaries Wk {M < k < N — 1) such 
that the {Wk : < fc < — 1} set is the same as Rm- And in Appendix A we will show that Rm is an approximate 
unitary representation of a right quasigroup (see Definition 1 in Sec. IIIip . (Sometimes a subset of Rm may suffice to 
be an approximate unitary representation of some right quasigroup, but that only reduces the entanglement cost of 
the protocol, and is therefore not a concern.) Then we apply our fast protocol in Sec. IIIII to implement a bipartite 
controlled unitary W = X]fc=o^ ® approximately. This is an approximate protocol, in the sense that for 

different measurement outcomes I, the implemented unitary may be different, but the average quantum operation 
is close to W under a reasonable measure. And since W is close to U, we have implemented Li approximately. 

Now we analyze the entanglement cost of this protocol. Every operator in Rm is the product of i = mdsidB — l)/2 
operators in Qd- From Appendix A, L should be at least some constant multiple of d^ilogds + log ^ + log |), where 
r] and 5 are parameters introduced in ((TU| . But L should also be at least as big as Lq in (HH). The entanglement cost 
of the protocol is logj size(i?m) < log2[{size{Qd))^] — L\og2 size{Gd) — L\og2 ds ebits, or more explicitly, 

0{L log ds) = 0{dl log dB ■ (log dB + \og-+ log - + log i)), (23) 

e 7] 

and the following theorem shows that the three error parameters e, 77, 6 can be combined into one parameter describing 
the deviation of the implemented quantum operation from the desired unitary U. 

Theorem 2. The eo := \\£u ^ ^\\o is related to e, rj and 5 in the following way: 

60 < 2V(e + ^)2+(5(2 + e)2. (24) 

Proof. The proof involves similar arguments as in Sec. IIIII Define Ek^i := — Wk, and Dk Wk — Vk- Then 

1 1 ^fc 1 1 00 < e, and the corresponding equation for (|1^ 

IIC^'-^'lloo 

/2 



Af-1 M-1 



- 1^ I] V^I^)®(^^M+^fc)IV'fe)®IOI 

l=Q k=0 

N-lM-1 

nT.J2 Pk{m{^Jk\{Ek,i + Dk)HEk,i + Dk)\iJk)m]' 



1=0 k=0 



N-1M~1 



1=0 k=Q 



= E^''^-(ll^'^-.'ll- + ll^'=ll- + 2||i?Mlloo-||^.|U) 
i.fceC 

l.k^C 

< 7(7+^^7+^(2+^, (25) 



1/2 



where C is the set of {k,l) pairs that satisfy \\Ek,i\\oo < V, see Hence eo < 2\\U'-V'\\oo < '2y/{<^ + + <5(2 + e)^. 

□ 
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We can always choose e, rj, S to be small constants that are equal to each other, then log ^ > — log 4 — i log{6 + 
25^ + 5^/4) « — log 4 + i log J, hence log ^ is of at least the same order as log |, when e = rj = S is small. Therefore 
from ([23|l . we get 

Theorem 3. The entanglement cost (measured in ebits) of the approximate fast controlled unitary protocol in this 
section is 

0(4logds-log— ). (26) 
Co 

A practical issue is how to construct the local gates in the protocol, as they are quite complex for large ds- 
This requires knowing the structure of the right quasigroup Q. Once the operators in the approximate unitary 
representation of Q are fixed, the structure of the right quasigroup is to be found out through the method in Appendix 
A, and that depends a lot on how to find the best approximation for a given unitary using the unitaries in the set 
{PFfc}. Each Wk is a product of operators from some fixed generating set Gd- There is some work in the literature 
(e.g. [23, H^l) this topic of decomposing a given unitary into a product of gates from a fixed generating set, but 
our problem is slightly different, as the operators Wk in this paper are in a subset of the set of all possible products of 
a fixed length. Nonetheless, the ideas in [2^] are still useful and they should lead to some algorithm that runs faster 
than simply enumerating all the allowed products and picking the one closest to the target unitary. There is some 
other work in the literature on the approximation of unitaries in SU{d) with a finite quasigroup, see [U,!!^, but we 
have not applied the results of those papers to the current problem; on the other hand, our construction in this paper 
can be viewed as a scheme for approximation of the special unitary group SU{d) by some right quasigroup. 

B. An example 

Sometimes it might be possible to use some other {W^fc} set than the one given in the previous subsection, to 
save entanglement cost or to achieve greater accuracy. This may happen when the controlled operators Vk are 
simultaneously block-diagonal. The idea is to use the known constructions (e.g. those in Sec. IIV Al or Sec. |lT]) for 
each block, and then combine those. One specific example is as follows: 

Example 3. Suppose the unitary to be implemented is on a 3 x 4 dimensional space: 

2 2 

U = Y^ \k){k\ ^Vk^Y. ® (^i'^ ® ^i'^)' (27) 

where Vjf^'' are on a 2-dimensional subspace 'Hg\ and Vjf^'' are on a 2-dimensional subspace H^^^ orthogonal to 'H^''. 
V^^^ = l2,vl^^ = exp(z7rcr:,/3), vj^^ = exp(i7rcr^/4), and V^^^ = V^^^ = h, V^^ = a,, {h is the 2 x 2 identity matrix; 
ax and cr^ are Pauli matrices.) We can choose a {T^} set on the subspace H^-* using the method in the previous 
subsection, and choose the set {Zk : k — — {h,^^} on "H^', and combine the operators by taking the direct 
sum: W'f. = Tyk/2\ ® ^(fc mod 2)- Then the {Wf,} set should form an approximate unitary representation of some right 
quasigroup, thus it can be used in place of the {VFfc} set on a 4-dimensional space. The size of {VF^} is just two times 
that of {Tfc}, and is thus smaller than the size of {VF/c} obtained by using the method in the previous subsection on 
the 4-dimensional space % b (for the same degree of accuracy in approximation) , hence this construction saves some 
entanglement resource. 

V. COMPARING THE FAST PROTOCOLS FOR CONTROLLED UNITARIES 
A. Adapting the nonlocal measurement protocol by Clark et al. to a fast unitary protocol 

Clark et al. 16] introduced some instantaneous measurement protocols for bipartite observables. In this section we 
argue that the general protocol in Sec. 6 of that paper can be adapted to a fast protocol for implementing bipartite 
unitaries with similar entanglement cost. 

In an instantaneous measurement protocol, each of the two parties performs a local measurement on his/her input 
system and part of the shared entangled state, and possibly some local ancillary system, and then they both send 
the measurement outcomes via classical channels to a third party, who calculates the final outcome of the nonlocal 
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measurement from the classical input he receives. Not all instantaneous measurement can be adapted to a nonlocal 
unitary protocol. For example, we do not know how to adapt some measurement protocols for some special types of 
observables in [ill i^i |26l | to fast nonlocal unitary protocols. 

However, the general measurement protocol in Sec. 6 of flG*! can indeed be adapted, and the method is quite simple: 
Alice and Bob each does an additional teleportation of the part of the target output state that belongs to the other 
party near the end of their protocol, just before doing the final measurement. Note that only one of the teleportations 
in the two directions will be actually sending the target state, because the target state will only be in the party that 
terminates "earlier" than the other party ("earlier" is in the sense of the flow diagrams in |16i|), but neither party 
knows if the other party had terminated and hence needs to act as if the target state is in his/her own hands. Then 
each party sends all the measurement outcomes (from all steps of the protocol so far) to the other party, and upon 
receipt of the classical messages each party figures out where the output system is. Without loss of generality, assume 
Alice terminated first. By now the output system is already distributed to Alice and Bob, but still lacks two final local 
corrections, one is only on Bob's side corresponding to Alice's measurement outcomes in the last teleportation step we 
added, and the other involves both parties and corresponds to the outcomes of Bob's last measurement. Then Alice 
and Bob do these local unitary corrections, with the correction corresponding to the latest measurement being done 
first. Note that for the second local corrections to be local, the last measurement by Bob (as a step of teleportation) 
should be as if he were teleporting the two subsystems (belonging to Alice and Bob at the end) individually, and this 
is indeed the way in ITg'] that teleportation is done - individually on each qubit. Of course, no final measurement on 
the output state is needed in the fast unitary protocol, unlike the instantaneous measurement protocol in which the 
final state is destroyed in a measurement. In order for the output system to be at some fixed location no matter what 
the intermediate measurement outcomes are, a last step of the whole protocol is that each of the two parties swaps 
his/her own part of the output system into a "blank" system at some fixed location. 

Now let us calculate the extra entanglement cost in the last teleportation step. Suppose the unitary is on a x 
space, the part that needs to be teleported from Ahce to Bob is of dimension ds, and the part that needs to be 
teleported from Bob to Alice is of dimension dA, and the last local swaps do not need entanglement, hence the extra 
entanglement cost is log2{d Ads) ebits. This quantity is quite small compared with the entanglement cost of the earlier 
parts of the protocol, hence the scaling behavior of the entanglement cost is the same as that of the instantaneous 
measurement protocol. 

B. Comparing the entanglement cost of various protocols 

Now we compare the entanglement cost of the fast unitary protocols in (or adapted from) [l^ . [isl [l6j , and our 
protocols in this paper, for implementing bipartite controlled unitaries. It should be noted that our protocols in this 
paper are specifically designed for controlled unitaries, while these other protocols are for general unitaries. Another 
point worth mentioning, since it will not be mentioned in the comparison of asymptotic entanglement cost in the next 
paragraph, is that our protocol tends to perform well when the controlled operators form a representation of a small 
group. For example, U = J2k=o ^k, with Vi = J, V2 = diag(l, e^'^'/^) can be implemented by o ur p rotocol 

in Sec. [Til (or the controlled-cyclic group protocol in [l|) using only logj 3 ebits, while the protocols in [l2l [Tsl. [T6| 
would need higher average-case (or worst-case) entanglement cost. 

For general controlled unitaries, the entanglement cost of our approximate protocol in Sec. lIVl is 0(d^ log -log ^). 
For the fast unitary protocol in Beigi and Konig Ijj], the error parameter e in their Theorem III.l can be identified 
with our and that theorem gives an entanglement cost of 0{log{dB)d^ / e^) , which is worse than ours. Clark et 
al. contains an instantaneous measurement protocol that can be adapted to a fast unitary protocol, as discussed 
in Sec. IV A( and that protocol would need an average case entanglement cost that is exponential in dAds, but 
independent of the error parameter eg. The fast unitary protocol in Sec. 4 of Buhrman et al. jl^ . which is based 
on the instantaneous measurement protocol in [27| . also has an entanglement cost exponential in dAds, while the 
dependence on the error probability e is polynomial in i (this e can also be identified with cq), which is unlike the 
cost of our protocol which is linear in log ^ . 

According to the discussions above, our protocol is quite efficient for general controlled unitaries, although these 
other protocols mentioned above might have improved versions specifically designed for controlled unitaries. The 
entanglement cost also depends a lot on the specific form of the unitary. As a result, for a randomly chosen controlled 
unitary, the entanglement cost of our protocol may be less or more than the other protocols, depending on the form 
of the unitary. 
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VI. CONCLUSIONS 

In conclusion, we have introduced a fast protocol that implements the so-called "controlled-group" unitaries exactly, 
where the controlled operators form a subset of a projective representation of a finite group. The difference compared 
to the controlled unitary protocols in [l[ is that the group could be non-Abelian, and the representation could be 
projective. We have also introduced a modified version of the protocol that uses right quasigroups, and showed that 
it can be used to implement all controlled unitaries approximately. In doing so, we have used some literature results 
on how to approximate unitaries in the special unitary group SU{d) by products of unitary operators from a given 
set. The entanglement cost of our general controlled-unitary protocol is compared with other fast unitary protocols 
in the literature. The cost of our protocol is small when the controlled operators form a representation of a small 
group, and the scaling behavior with the error parameter is not too bad. 

The fast controlled unitary protocols discussed in this paper are a special class of fast unitary protocols. A general 
open problem is to find the lower bound of entanglement cost of all possible fast unitary protocols. It might be easier 
to first work on some special types of unitaries. Specifically, for the controlled-group unitaries 14 — X^fcLo^ ^ ^k, 

where the controlled operators (exactly) form a subset of a projective representation of a finite group G, our findings 
so far seem to suggest that log2 \G\ ebits of entanglement may be needed for general choices of the 14, unless they 
form a projective representation of a subgroup of G, in which case we could have used that subgroup instead: or when 
the dimensions of Ha and T-Ib are small so that other protocols utilizing the idea of teleportation (e.g. [12, [H, [3) 
might have lower entanglement cost. 

Some new techniques might be needed to study whether the entanglement cost of our fast protocol is near the 
optimal lower bound. The concept of asymptotic entanglement cost might be useful. This is the cost per copy to 
implement many copies of the same unitary. Is the one-shot entanglement cost equal to the asymptotic entanglement 
cost? Is the minimum entanglement cost the same for the two distinct cases of approximate and exact implementation? 
Are the lower bounds under the fast protocols related to the lower bounds under the slow protocols? The study of 
these problems may shed light on the properties of nonlocal unitaries themselves. 

Other problems for further investigation include: to find specific applications of our protocols in position-based 
quantum cryptography [ol-fT^: to adapt our protocols to instantaneous measurement protocols (the paper [l^ is an 
example where a fast unitary protocol and an instantaneous measurement protocol are discovered using the same 
techniques); to generalize to fast protocols for implementing tripartite or multipartite unitaries; to generalize to fast 
protocols for nonlocal non-unitary quantum operations. 

The use of a right quasigroup or quasigroup structure turned out to be useful for approximate implementation of 
controlled unitaries. Are quasigroups useful for the implementation of other unitaries or quantum operations? An 
equivalent concept, Latin squares, has found many applications, e.g. in teleportation and dense coding schemes [28j . 
in constructing unitaries with certain "maximally-entangling" property [29], in constructing mutually unbiased bases 
[30I - I32I , and in quantum error correction [33| . We hope the use of quasigroups (or similar algebraic structures) could 
help solve more different types of problems in quantum information theory. 
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Appendix A: Choosing a suitable right quasigroup for the protocol in Sec. IIVI 

In this appendix, we show that it is indeed possible to find a finite right quasigroup Q such that the {Wk} — Rm set 
chosen in Sec. IIVI is an approximate unitary representation of Q. The operators Wk all act on T-Lb, hence we denote 
d := ds for simplicity. 

From the discussion in Sec. IIVI the operators in {VFfe} — Rm are almost uniformly distributed in the SU{d) group, 
and the distribution of the operators in Rm approaches the uniform distribution in SU{d) in an exponentially fast 
manner. Our aim is to find the structure of a right quasigroup (Q, *) such that {W4} form an approximate unitary 
representation of Q in the sense of Definition 1. For each k, we need to find at least A^(l — 6) distinct values of j 
such that li W^i(j,fc) W4 — W^jlloo < '7, where N is the size of the set {Wk} and also the size of Q. Since l{j,k) ^ k — j, 
from the definition of a right quasigroup, j — I *k \s unique for fixed I and fc, and I is uniquely determined by j and 
k. That means, for each fixed fc, we need to find a perfect matching of j and I suitable for the "approximate unitary 
representation" , where the possible values of j and I are between and A^ — 1 . A way of finding such a matching is 
as follows: partition the set SU{d) into a finite number of sets Hq, 1 < 9 < i, each having the property that for any 
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two operators U and V in the same set iJg, \\U — V\\oo < V- Since Wi are almost uniformly distributed in SU{d), 
WiWk with fixed k are almost uniformly distributed. For fixed k, we now try to match each WiWk with members of 
{VTj}, the latter set being also almost uniformly distributed. The matching proceeds as follows: each WiWk in a set 
Hq is matched with any Wj in the same Hq, and this is continued until no new pair can be found in this way. Then, 
all the remaining unmatched operators from the two sets are matched into pairs arbitrarily. Since the two sets are 
almost uniformly distributed, the portion of pairs matched in the first step is arbitrarily close to 1, when the length 
n of products used in generating the two sets is increased. Hence for a large portion of j, — Wj||oo < ^-^d 

this portion approaches 1 in an exponential manner (i.e. the complementary portion decreases exponentially) as m 
increases, according to (|2T|) . Hence for fixed small constants rj and 6, it is always possible to find a value of m that 
scales as C"(logci + log i + log |), where C" is some constant independent of d, such that the generated set {Wk} of 
products of md{d — l)/2 operators in Qd is an approximate unitary representation of Q. The logd term appears for 
the same reason as in (|22|) : it is because of the '^'-'^~^'> term on the right-hand side of (PT|) . In conclusion, when the 
length L = nid{d — l)/2 of products in Rm is of the order 0(d^(logd + log i + log |)), there is a right quasigroup 
(Q, *) such that Rm is an approximate unitary representation of Q. 
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